Guyvan v Ukraine: Employer monitoring of work mobile breaches Article 8

The European Court of Human Rights has delivered a significant judgement concerning workplace privacy, finding that Ukraine violated Article 8 of the Convention in Guyvan v Ukraine (Application no. 46704/16). The case centred on an employer's collection of data from an employee's work mobile telephone during an internal investigation, and the subsequent failure of domestic courts to properly assess whether such monitoring was justified.

Mr Guyvan, who had used his mobile number since 2002, later had it designated as his work telephone paid for by his employer, P. company. Under company policy introduced in 2010, employees could use work phones for private calls, including international roaming, provided they reimbursed costs exceeding the monthly work allowance.

In February 2015, P. company launched an internal investigation after noticing international roaming charges during periods when attendance records showed Mr Guyvan at his workplace. The employer requested detailed information from the mobile operator, including dates, times, foreign telephone companies used, countries accessed, telephone numbers contacted, and call durations between January 2014 and January 2015.

Mr Guyvan subsequently brought proceedings against his employer, arguing that this constituted unlawful collection and processing of his personal data under the Personal Data Protection Act. The domestic courts at all three levels rejected his claims, concluding that the information obtained did not constitute personal data and that the employer, as owner of the telephone number, was entitled to request such information from the operator.

The Court's analysis

The Strasbourg Court emphasised that whilst the measure complained of was imposed by a private employer rather than state authorities, Article 8 imposes positive obligations on states to secure respect for private life even in relations between private individuals. The state's responsibility may be engaged where it fails to provide adequate protection of Convention rights.

Applying the framework established in Bărbulescu v Romania, the Court identified several critical factors that domestic courts must assess when examining workplace monitoring: prior notification, extent and intrusiveness of monitoring, legitimate justification, availability of less intrusive alternatives, consequences for the employee, and adequate safeguards against arbitrariness.

Crucially, the Court found that whilst P. company's internal orders permitted obtaining information to determine billing responsibility, the February 2015 requests served the entirely different purpose of establishing Mr Guyvan's location abroad on specific dates. The data collected included telephone numbers contacted and countries where roaming services were used—information the domestic courts themselves acknowledged was unnecessary for determining workplace presence.

The Court determined that such information, revealing the applicant's location at particular times and communication patterns, clearly constituted personal data falling within Article 8's protection. The information about roaming services, despite being "technical" in nature, retained its personal character.

Failure of domestic protection

The Court concluded that Ukrainian courts failed to conduct the necessary proportionality analysis or give proper consideration to data protection issues. By determining that the information was not personal data, the domestic judiciary avoided assessing whether the Bărbulescu criteria were satisfied. This meant Mr Guyvan was denied access to a judicial body capable of determining whether his workplace communications monitoring was lawful.

The judgement, delivered on 6 November 2025, represents a unanimous finding that Ukraine failed to fulfil its positive obligations under Article 8. It reinforces the principle that domestic courts must engage substantively with privacy concerns in workplace monitoring cases, applying established criteria rather than categorically excluding certain types of information from data protection frameworks.